Latest news, tutorials, and insights from the Spicy category.
Introduction In April 2021 Juniper networks reported on a new Linux rootkit designed to steal SSH credentials from Linux servers. A month later Netlab 360 published a deeper analysis of the same rootkit they named “Facefish”. …
read more about Detecting the Facefish Linux Rootkit with ZeekIntroduction I previously blogged about the Zeek OpenVPN Binpac and Spicy protocol analyzers, but that is only one quarter of the popular VPN protocols I see on networks I monitor. The four main VPN protocols, in…
read more about Zeek’s IPSec Protocol AnalyzerWe are happy to announce the release of Spicy 1.0, an open source parser generator that makes it much easier for Zeek—and other applications—to support new protocols and file formats. We had made an initial, experimental…
read more about Spicy 1.0 — Robust Parsers for Protocols & File FormatsIntroduction and Background I last wrote about detecting OpenVPN with Zeek, and to understand this blog you should familiarize yourself with that post. This blog will not repeat the basics of OpenVPN, but instead it will…
read more about A Zeek OpenVPN Protocol Analyzer in SpicyWe are very happy to announce a new Zeek project now available on GitHub. The Spicy parser generator makes it substantially easier for Zeek to support and parse new protocols and file formats. I will tell…
read more about Announcing the (New) Spicy Parser Generator